{"id":1852,"date":"2012-04-03T00:00:00","date_gmt":"2012-04-03T00:00:00","guid":{"rendered":"http:\/\/otava.test\/hipaa-hosting-qa-with-a-certified-hipaa-practitioner-security-specialist\/"},"modified":"2012-04-03T00:00:00","modified_gmt":"2012-04-03T00:00:00","slug":"hipaa-hosting-qa-with-a-certified-hipaa-practitioner-security-specialist","status":"publish","type":"post","link":"https:\/\/www.otava.com\/blog\/hipaa-hosting-qa-with-a-certified-hipaa-practitioner-security-specialist\/","title":{"rendered":"HIPAA Hosting Q&A with a Certified HIPAA Practitioner & Security Specialist"},"content":{"rendered":"

We get a lot of questions from clients about HIPAA compliance and security. To help clear up any confusion, our Certified HIPAA Practitioner (CHP) and Certified HIPAA Security Specialist (CHSS) Joe Dylewski of ATMP Solutions<\/a> answered the questions we shared with him below:<\/p>\n

Q: What is the association of NIST w\/ an independent HIPAA audit?<\/strong>
\nA: NIST is the National Institute of Standard and Technology. ATMP, utilizing SecureGRC, leverages NIST guidance when conducting HIPAA Risk Assessments.<\/p>\n

Q: Is it possible to be HIPAA compliant without an HROC (HIPAA Report on Compliance \u2013 or without a HIPAA risk assessment?<\/strong>
\nA: No. 45 CFR 164.308(a)(1)(ii)(a) is a required Implementation Specification under the HIPAA Security Rule, Security Management Process Standard. An HROC is not a required document. However, organizations must be able to produce evidence that they have completed an assessment and resolved any deficiencies or vulnerabilities. An HROC demonstrates the auditable steps that an organization took in that process.<\/p>\n

Q: Can you explain where the HITECH act specifies antivirus is \u201crequired\u201d?<\/strong>
\nA: \u201cProtection from Malicious Software,\u201d 45 CFR 164.308(a)(5)(ii)(b), is an Addressable Implementation specification under the HIPAA Security Rule, Security Awareness and Training Standard. Addressable does not equate to Optional.<\/p>\n

\u201cProtection from Malicious Software\u201d is one of the key HIPAA Implementation Specifications as it speaks to the Confidentiality, Integrity, and Availability of Electronic Protected Health Information.<\/p>\n

Q: What about offsite backup and\/or disaster recovery?<\/strong>
\nA: The ability to store a recoverable set of Electronic Protected Health Information (ePHI), and test that process, are critical components that are governed by multiple HIPAA Implementation Specifications and Standards:<\/p>\n

Contingency Plan Standard, 45 CFR 164.308(a)(7<\/em>)(i)<\/em><\/p>\n